id: CVE-2025-26399

info:
  name: "Solarwinds - Insecure Deserialization"
  author: vedas-arpsyndicate
  severity: critical
  description: |
    SolarWinds Web Help Desk was found to be susceptible to an unauthenticated AjaxProxy deserialization remote
    code execution vulnerability that, if exploited, would allow an attacker to run commands on the host machine.
    This vulnerability is a patch bypass of CVE-2024-28988, which in turn is a patch bypass of CVE-2024-28986.
  reference:
    - https://www.exploit.observer/?keyword=CVE-2025-26399&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=solarwinds&match=exact
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2025-26399
    cwe-id: CWE-502
  metadata:
    verified: false
  tags: cve,cve2025,solarwinds,webhelpdesk,deserialization,rce,kev,vkev,passive
http:
  - raw:
      - |
        GET /helpdesk/WebObjects/Helpdesk.woa HTTP/1.1
        Host: {{Hostname}}

    host-redirects: true
    max-redirects: 2

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains_any(body, "Web Help Desk Software", "SolarWinds WorldWide", "HCS Web Help Desk")'
          - 'compare_versions(version, "< 12.8.7")'
        condition: and

    extractors:
      - type: regex
        name: build_token
        part: body
        group: 1
        regex:
          - "\\?v=([0-9]+_[0-9]+_[0-9]+_[0-9]+)"
        internal: true

      - type: dsl
        name: version
        dsl:
          - 'replace(build_token, "_", ".")'